EnCase

You are a computer forensic examiner tasked with determining what evidence is on a seized computer. On what part of the computer system will you find data of evidentiary value?

You are a computer forensic examiner explaining how computers store and access the data you recovered during your examination. The evidence is a log file and was recovered as an artifact of user activity on the ___________, which was stored on the ____________, contained within a _____________ on the media.

You are a computer forensic examiner investigating a seized computer. You recovered a document containing potential evidence. EnCase reports the file system on the forensic image of the hard drive is FAT (File Allocation Table). What information about the document file can be found in the FAT on the media? (Choose all that apply.)

You are a computer forensic examiner investigating media on a seized computer. You recovered a document containing potential evidence. EnCase reports the file system on the forensic image of the hard drive is NTFS (New Technology File System). What information about the document file can be found in the NTFS master file table on the media? (Choose all that apply.)

You are preparing to lead a team to serve a search warrant on a business suspected of committing large-scale consumer fraud. Ideally, you would you assign which tasks to search team members? (Choose all that apply.)

You are a computer forensic examiner at a scene and have determined you will seize a Linux server, which according to your source of information, contains the database records for the company under investigation for fraud. What is the best practice for “taking down” the server for collection?

You are a computer forensic examiner at a scene and are authorized to only seize media that can be determined to have evidence related to the investigation. What options do you have to determine whether evidence is present before seizure and a full forensic examination? (Choose all that apply.)

You are a computer forensic examiner at a scene and have determined you will need to image a hard drive in a workstation while onsite. What are your options for creating a forensically sound image of the hard drive? (Choose all that apply.)

You are a computer forensic examiner and have imaged a hard drive on site. Before you leave the scene, you want to ensure the image completely verifies as an exact forensic duplicate of the original. To verify the EnCase evidence file containing the image, you should:

You are a computer forensic examiner and need to verify the integrity of an EnCase evidence file. To completely verify the file’s integrity, which of the following must be true?

You are a computer forensic examiner and need to determine what files are contained within a folder called Business documents. What EnCase pane will you use to view the names of the files in the folder?

You are a computer forensic examiner and need to view the contents of a file contained within a folder called Business documents. What EnCase pane will you use to view the contents of the file?

You are a computer forensic examiner and are viewing a file in an EnCase evidence file. With your cursor, you have selected one character in the file. What binary term is used for the amount of data that represents a single character?

You are a computer forensic examiner and need to search for the name of a suspect in an EnCase evidence file. You enter the name of the suspect into the EnCase keyword interface as John Doe. What search hits will be found with this search term with the default settings? (Choose all that apply.)

You are a computer forensic examiner and need to determine if any Microsoft Office documents have been renamed with image extensions to obscure their presence. What EnCase process would you use to find such files?

You are a computer forensic examiner and want to reduce the number of files required for examination by identifying and filtering out known good or system files. What EnCase process would you use to identify such files?

You are a computer forensic examiner and want to determine if a user has opened or doubleclicked a file. What folder would you look in for an operating system artifact for this user activity?

You are a computer forensic examiner and want to determine when a user deleted a file contained in the Recycle Bin. In what file is the date and time information about the file deletion contained?

You are a computer forensic examiner and want to determine how many times a program was executed. Where would you find information?

You are a computer forensic examiner and want to examine any e-mail sent and received by the user of the computer system under investigation. What e-mail formats are supported by EnCase? (Choose all that apply.)